Dataset Regime

In a 2016 decision, the Federal Court of Canada concluded that CSIS had exceeded its legal authority by keeping information that was not related to a threat to the security of Canada or to the target of a CSIS warrant (X (Re), 2016 FC 1105). In response, recognizing that a modern security and intelligence agency could not carry out its investigation functions without conducting data analytics on Canadian data that is not directly threat- related, Parliament amended the CSIS Act in 2019, creating what is referred to as the “dataset regime.”

The CSIS Act defines a dataset as a “collection of information that is characterized by a common subject matter, stored as an electronic record, contains personal information, and is relevant to the performance of CSIS’ duties under sections 12 to 16 of the CSIS Act but cannot be collected or retained under those sections.” A dataset may contain anything from a very little to a vast quantity of information.

Analysing information in the datasets it assembles can help CSIS make connections or identify patterns and trends that would not be apparent using traditional investigative techniques.

Under the dataset regime, CSIS activities related to datasets require ministerial authorizations, and subsequent review by the IC, in three instances:

• the Minister's determination of classes of Canadian datasets
• the Minister's authorization, or that of the person designated by the Minister, to retain a foreign dataset (the Director of CSIS has been designated for this purpose)
• the Director's authorization to query a Canadian or foreign dataset in exigent circumstances